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DETAILED ACTION 

Election/Restrictions 

1. Restriction to one of the following inventions is required under 35 U.S.C. 121: 

I. Claims 1-15 and 30-43 drawn to a method of identifying unwanted 
messages, classified in class 726, subclass 22. 

II. Claims 44-51 drawn to a method of classification of a message, classified 
in class 726, subclass 1. 

Inventions ( I ) a method of identifying unwanted messages and ( II ) a method of 
classification of a message related as subcombinations disclosed as usable together 
in a single combination. 

The subcombinations are distinct from each other if they are shown to be separately 
usable. In the instant case, invention ( II ) drawn to a method of classification of a 
message, classified in class 726, subclass 1 do not require inspecting of the payload 
portion of a message for example, and invention ( II ) drawn to a method of 
identifying unwanted messages, classified in class 726, subclass 22 do not require a 
message communicated with a set of rules for example. 

Since applicant has received an action on the merits for the originally presented 
invention, this invention has been constructively elected by original presentation for 
prosecution on the merits. Accordingly, claims 44-51 are withdrawn from 
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consideration as being directed to a non-elected invention. See 37 CFR 1.142(b) 

andMPEP §821.03. 

Applicant is reminded that upon the cancellation of claims to a non-elected 
invention, the inventorship must be amended in compliance with 37 CFR 1.48(b) if one 
or more of the currently named inventors is no longer an inventor of at least one claim 
remaining in the application. Any amendment of inventorship must be accompanied by 
a request under 37 CFR 1.48(b) and by the fee required under 37 CFR 1.1 7(i). 

1. The Amendment, and remarks therein, received on 2/7/06 have been entered and 
carefully considered. 

2. The Amendment introduces a new limitation into the originally sole independent 
claims 1 and dependent claims 6-7, 9-12, cancels claim 5 and ads new claims 30- 
51. 

3. The text of those sections of Title 35, U.S. Code not included in this action can be 
found in a prior office action. 

Response to Amendment 

4. The new Oath/Declaration received on 2/7/06 is accepted. 

5. In light of the amendments introduced to claims 7 and 10 the previous 35 U.S.C. 

1 12, second paragraph Office Action rejection directed towards 7, 1 , 23 and 26 are 
withdrawn. 
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6. In regard to the art rejection applicant's arguments are essentially directed towards 
the "recategorizing the security condition of the message based on the updated 
stored data". Applicant argues that the art of record does not disclose and does not 
suggests such a limitation. 

7. Applicant's arguments have been carefully considered but they were not found 
persuasive. 

8. Cotten discloses categorizing a message with indeterminate condition (flag the 
message for later processing, col. 4 lines 36) and clearly states that the mail can be 

9. Claims 1-15 and 30-43 have been examined. 

Claim Objections 

10. Claims 36-37 are objected to because of the following informalities: "at one least 
one" should be "at least one". Appropriate correction is required. 

Claim Rejections - 35 USC §112 

The following is a quotation of the first paragraph of 35 U.S.C. 112: 

The specification shall contain a written description of the invention, and of the manner and process of 
making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the 
art to which it pertains, or with which it is most nearly connected, to make and use the same and shall 
set forth the best mode contemplated by the inventor of carrying out his invention. 

11. Claims 36 and 37 are rejected under 35 U.S.C. 112, first paragraph, as failing to 
comply with the written description requirement. The claim(s) contains subject 
matter which was not described in the specification in such a way as to reasonably 
convey to one skilled in the relevant art that the inventor(s), at the time the 
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application was filed, had possession of the claimed invention. In particular no 
recategorizing the security condition of the message when an alarm score 
decreases was found in the applicant's specification. 

12. Claims 36 and 37 are rejected under 35 U.S.C. 1 12, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter 
which applicant regards as the invention. In particular the phrase "when the stored 
data is updated such that ..." is not clear. It is not clear whether the claims limitation 
should be read as though increasing an alarm score of at least one of the 
characteristic of a message results in recategorizing the security condition of the 
message or whether the limitation implies that recategorizing the security condition 
of the message results in an alarm score of at least one of the characterisict of a 
message increase. 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

13. Claims 1-15, 30-35 and 38-43. 

14. As per claims 1-15 and 30-43 Paul teaches inspecting a message being 
communicated to a first device in a message exchanging system that includes two or 
more devices and identifying characteristics of the message (col. 5 lines 1-10), 
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comparing the characteristics of the message with data in the message exchanging 
system (col. 5 lines 56-62 and Fig. 2 and col. 5 line 63-col. 6 line 15), based on 
comparison results, identifying a security condition from among at least one of 
acceptable, unacceptable (col. 6 line 5-col.7 line 10), processing the message based 
on the security condition (col. 6 line 5-col.7 line 10), wherein the processing the 
message includes rejecting the message if the security condition associated with the 
message reflects that unacceptable state (col. 6 lines 5-50 and col. 6 line 64-col.7 
line 1), accepting the message if the security condition associated with the message 
reflects the acceptable state (col. 6 lines 52-55 and col. 7 lines 8-10). 
15. Paul teaches that the characteristics of the payload portion include information other 
than address information (col. 9 lines 51-52). 

Paul does not teach that if the security condition associated with the message 
reflects the indeterminate state, inspecting at least one other message subsequent 
to the processing of the message and assuming a message when comparison of the 
characteristics reveals a threshold number of messages having a shared 
characteristic. 

Cotten discloses indeterminate state messages condition, inspecting subsequent 
messages to detect undesired conditions (Cotten, col. 4 lines 35-36 and 46-58) and 
assuming a message when comparison of the characteristics reveals a threshold 
number of messages having a shared characteristic (col. 4 lines 21-24). 
It would have been obvious to one of ordinary skill in the art at the time of applicant's 
invention to inspect at least one other message subsequent to the processing of the 
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message if the security condition associated with the message reflects the 
indeterminate state and assuming a message when comparison of the 
characteristics reveals a threshold number of messages having a shared 
characteristic (col. 4 lines 21-24) as taught by Cotten, given the benefit of more 
accurate security assessment and proper treatment of unwanted bulk messages . 
Paul in view of Cotten doe not explicitly teach updating the stored data to indicate 
characteristics of the at least one other message that has been inspected. However, 
the limitation is implicit. As clearly disclosed by Paul, filtering exclusion lists is 
automatically created, maintained and modified based upon filtering instructions 
received from a control center (Paul, col. 6 lines 10-15) and the control center 
receives the information based on the constantly incoming messages (Paul, col. 4 
lines 19-67). Similarly implicit would have been reprocessing (rescanning) and 
recategorizing the security condition of the message (or any of the indetermined 
messages) based on the updated stored data especially since viruses and spam 
continuously mutate and something that is not clearly identified at the very moment 
can clearly be identified as time progress, as also clearly shown in Cotten's invention 
(e.g. Cotten, col. 4 lines 35-36). 

16. Rejecting/deleting the message if the security condition identified includes a hostile 
indicator would have been implicit. 

17. As per claim 41 Paul in view of Cotten do not explicitly teach reprocessing the 
message includes generating an alarm if the security condition reflects the 
unacceptable state. However, the computer systems frequently (also as shown by 
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Paul, above) work automatically without a user interaction. As a result, an alarm 
(identifying a particular condition) must be present for the system to recognize the 
need for executing a particular routine (e.g. reprocess a message). 
18. As per claims 38-39 Paul in view of Cotten do not teach recategorizing the security 
condition based on an administrator updates. However, Official Notice is taken that 
it is old and well-known practice to recategorize the security condition based on an 
administrator's update (e.g. removing or adding a sender's address from a SPAM list 
per request of a user for example). It would have been obvious to recategorize the 
security condition based on an administrator's update given the benefit of immediate 
response to incorrect classification. 

Conclusion 

Claim 36 as best understood overcomes the art of record. 
Neither Paul nor Cotton teach utilizing an alarm score in recategorizing a traced 
message categorized with indeterminate state condition. Even if one argued that it 
would have been obvious to utilize an alarm score in recategorizing the message if the 
alarm score increased it would have not been obvious to one of ordinary skill in the art 
at the time of applicant's invention to recategorize the message if the alarm score 
decreased. Although it is old and well-known practice to keep messages with 
indeterminate state condition (e.g. quarantine) and use a warning level when particular 
characteristics occur (e.g. warn an administrator when a number of received messages 
with a particular characteristics are received) the found prior analogous art did not 
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suggest recategorizing the state condition of a message when the alarm score is 
decreased. 

In case of any amendments, especially any amendments to the limitations of claims 36- 
37, applicant is advised to clearly articulate the claim invention as well as provide 
support in the specifications. 

The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

U.S Patent No. 6,460,050, 
U.S Patent No. 6,643,686. 

Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 
§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
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the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Peter Poltorak whose telephone number is (571) 272- 
3840. The examiner can normally be reached Monday through Thursday from 9:00 
a.m. to 4:00 p.m. and alternate Fridays from 9:00 a.m. to 3:30 p.m 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Jacques Louis Jacques can be reached on (571) 272-6962. The fax phone 
number for the organization where this application or proceeding is assigned is (571) 
273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through Private PAIR only. For 
more information about the PAIR system, see http://pair-direct.uspto.gov. Should you 
have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-217-9197 (toll-free). 





